Package: webcit Version: 8.05-dfsg-1 Severity: important Tags: patch Dear Maintainer,
The LDFLAGS hardening flags are missing because they are not set
in debian/rules.
The following patch fixes the issue.
diff -u webcit-8.05-dfsg/debian/rules webcit-8.05-dfsg/debian/rules
--- webcit-8.05-dfsg/debian/rules
+++ webcit-8.05-dfsg/debian/rules
@@ -41,7 +41,7 @@
ifneq "$(wildcard /usr/share/misc/config.guess)" ""
cp -f /usr/share/misc/config.guess config.guess
endif
- CFLAGS="$(CFLAGS)" ./configure \
+ CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)" ./configure \
--host=$(DEB_HOST_GNU_TYPE) \
--build=$(DEB_BUILD_GNU_TYPE) \
--prefix=/usr/sbin/ \
The following patch disables the non-verbose build to make it
easy to (automatically) spot missing (hardening) flags. Please
apply it as well.
--- webcit-8.05-dfsg.orig/Makefile.in
+++ webcit-8.05-dfsg/Makefile.in
@@ -28,7 +28,7 @@
mkdir-init:
mkdir locale
-.SILENT:
+#.SILENT:
.SUFFIXES: .cpp .c .o
To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (hardening-check doesn't catch everything):
$ hardening-check /usr/sbin/webcit
/usr/sbin/webcit:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
(Position Independent Executable and Immediate binding is not
enabled by default.)
Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.
Regards,
Simon
[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
--
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
signature.asc
Description: Digital signature
